14

okay so we we have the mongodump tool, it has --password option. Everything works great except this plain password is visible in ps output to everybody.

our database has plain user/password authentication.

The only thing that I found to work is doing like this

echo secretpwd |  mongodump --username backup --oplog

no trace of password in ps and still working.

Is there any better way?

Sergey Grechin
  • 876
  • 11
  • 14

2 Answers2

11

From the docs:

Changed in version 3.0.2: If you wish mongodump to prompt the user for the password, pass the --username option without --password or specify an empty string as the --password value, as in --password "" .

Seems like what you are doing is the recommended way.

Also, this can help further:

If the secret doesn't change between executions, use a special configuration file, ".appsecrets". Set the permissions of the file to be read-only by owner. Inside the file set an environment variable to the secret. The file needs to be in the home directory of the user running the command.

Community
  • 1
  • 1
galactocalypse
  • 1,905
  • 1
  • 14
  • 29
  • 1
    looks ugly anyway. Maybe it'd be slighly less ugly if we do it like cat /home/password.txt | mongodump .... Does echo show up in process list by the way? I think it does. – Sergey Grechin Aug 22 '15 at 07:24
  • Haha I just added a reference to something similar from another thread. – galactocalypse Aug 22 '15 at 07:28
  • 1
    Oh and echo doesn't show up because it doesn't spawn a new process in bash. Check [this](http://stackoverflow.com/questions/28840191/why-doesnt-echo-show-up-in-ps) out. – galactocalypse Aug 22 '15 at 07:34
1

Old post, but it looks like recent versions of mongodump do explicitly support reading the password from standard in. I didn't see anything about it in the documentation, but when I use a similar command to the one in the OP, mongodump generates output like:

reading password from standard input

I'm not sure if it's any better than using echo like in the OP, but I store the password in a file and then use it like this: mongodb --username backup < /path/to/password.txt

Dominic P
  • 2,284
  • 2
  • 27
  • 46